GDPR / Data Protection
How MAYAN ALFA handles personal data.
This notice explains how MAYAN ALFA handles personal data across the public website, direct communication, archive navigation, and the supporting services used to operate the project.
MAYAN ALFA operates a public research website and a small online store for eBooks and archive-access products (BRONZE, SILVER, GOLD). Personal data is therefore processed for direct contact, orders, customer accounts, payments, invoicing, and website security. MAYAN ALFA does not use advertising trackers, remarketing, behavioural profiling, or automated decision-making.
Last updated: September 2026
Controller and contact
The controller of personal data is David Hess, operator of MAYAN ALFA. For privacy requests, access requests, correction requests, or any other data protection question, contact david.hess@mayanalfa.com.
What is processed
- Contact data Name, email address, and message content when you write to the project.
- Order and billing data Name, billing address, email, phone if provided, ordered products, order history, and invoices.
- Customer account Login name, password stored only in hashed form, and saved addresses, if you create an account.
- Payment status Payments are handled by the payment provider. MAYAN ALFA does not receive or store full card numbers.
- Technical data IP address, browser information, server and security logs.
Purpose of processing
Personal data is used to answer messages, process orders, deliver eBooks and archive access, manage customer accounts, issue invoices and keep accounting records, and protect the website from misuse, spam, fraud, or technical disruption.
Recipients and transfers
Data is shared only with providers needed to run the website and store: web hosting, payment providers, email delivery, Automattic (Jetpack / WordPress.com image delivery network), and an accountant or tax adviser where required. Personal data is never sold. Where a provider processes data outside the EU, the transfer relies on appropriate safeguards such as the EU–U.S. Data Privacy Framework or standard contractual clauses.
Retention
- Orders and invoices For the period required by Czech accounting and tax law, up to 10 years.
- Customer accounts Until you delete the account or ask for deletion, except data that must be kept for completed orders.
- Messages As long as needed to handle the matter, and no longer than 3 years after the last contact.
- Server and security logs Short term, usually a few weeks to a few months.
What MAYAN ALFA does not do
The site does not use advertising or analytics cookies, remarketing, behavioural profiling, or automated decision-making. Personal data is not sold or rented. If this changes, this notice will be updated and consent will be requested before the new processing begins.
Legal bases
- Performance of a contract — Art. 6(1)(b) GDPR Processing orders, delivering eBooks and archive access, managing customer accounts, and answering questions before a purchase.
- Legal obligation — Art. 6(1)(c) GDPR Issuing invoices and keeping accounting and tax records.
- Legitimate interest — Art. 6(1)(f) GDPR Website security, server logs, prevention of fraud and abuse, answering general messages, and defending legal claims.
- Consent — Art. 6(1)(a) GDPR Only where consent is requested separately, for example a future newsletter. Consent can be withdrawn at any time.
Cookies
The site uses only cookies that are necessary for it to work: WordPress and WooCommerce cookies for the shopping cart, checkout, customer login, and security. These cookies are not used for tracking and do not require consent.
The site does not use advertising or analytics cookies. If such cookies are introduced later, they will only be used after you give consent.
Your rights
- Right to be informed Receive clear information about how personal data is handled.
- Right of access Request a copy of the personal data held about you.
- Right to rectification Ask for inaccurate or incomplete personal data to be corrected.
- Right to erasure Request deletion of personal data where the law allows.
- Right to restriction Ask for processing to be limited in certain situations.
- Right to data portability Receive applicable data in a structured and reusable format.
- Right to object Object to certain processing based on your individual situation.
- Right regarding automated decisions Not be subject solely to a decision made by automated processing where applicable.
- Right to withdraw consent Where processing is based on consent, withdraw it at any time without affecting earlier processing.
- Right to lodge a complaint You may contact the Czech Data Protection Authority (ÚOOÚ) if you believe your personal data has not been handled properly.
How to exercise your rights
Send a message to david.hess@mayanalfa.com and state which right you want to exercise. We will respond as required by applicable law.
You may also contact the Czech Data Protection Authority, ÚOOÚ, if you want to file a complaint.